1

See the Known Limitation VSECPC-1341 in the R80.20.M1 Known Limitations SK.

2

See the R80.20.M1 CloudGuard Controller Administration Guide for a list of supported gateways.

3

When you upgrade a vSEC Controller R80.10 or below to R80.20.M1, these files are overwritten with default values:

• $MDS_FWDIR/conf/vsec.conf
• $MDS_FWDIR/conf/tagger_db.C
• $MDS_FWDIR/conf/AWS_regions.conf

Before you begin the upgrade, back up all files you changed in the past.

4

Before you begin the upgrade on a vSEC Controller R80.10 or below, if you have a Cisco APIC server, keep only one URL.

After the upgrade, add the other URLs.

1

Connect to the command line on the Management Server.

2

Log in to Gaia Clish, or Expert mode.

3

On a Multi-Domain Server, go to the main MDS context:

mdsenv

4

Enable the CloudGuard Controller:

cloudguard on

The output shows:

CloudGuard IaaS turned on successfully

1

Connect to the command line on the Management Server.

2

Log in to Gaia Clish, or Expert mode.

3

On a Multi-Domain Server, go to the main MDS context:

mdsenv

4

Enable the CloudGuard Controller:

cloudguard off

Command prompts you:

Are you sure? [y/n: y to turn off, n to ignore]

After you confirm, the output shows:

CloudGuard IaaS turned off successfully

Note - When you disable CloudGuard Controller, CloudGuard Controller functionality does not work.

1

In your web browser, connect to the Gaia Portal on the R77.30 Security Gateway at:

https://<IP address of Gaia Management Interface>

2

From the left tree, click Upgrades (CPUSE) > Status and Actions.

3

Above the list of all software packages, click Showing Recommended packages and select All.

4

Select the R77.30 vSEC Controller Enforcer Hotfix package.

5

On the toolbar, click More > Verify.

6

Select the R77.30 vSEC Controller Enforcer Hotfix package.

7

On the toolbar, click Install Update.

8

The online installation starts immediately. The Security Gateway reboots when installation is complete.

1

Install the latest build of CPUSE Agent from sk92449 on the R77.30 Security Gateway.

See Section 3 to find the latest CPUSE build, and Section 4-A to download and import a CPUSE package.

2

In your web browser, connect to the Gaia Portal on the R77.30 Security Gateway at:

https://<IP address of Gaia Management Interface>

3

From the left tree, click Upgrades (CPUSE) > Status and Actions.

4

Click the Import Package button on the toolbar.

The Import Package window opens.

5

Click Browse and go to the CPUSE package (offline TGZ file or exported TAR file) of R77.30 vSEC Controller Enforcer Hotfix.

6

Click Upload.

7

Above the list of all software packages, click Showing Recommended packages and select All.

8

Select the imported CPUSE package.

9

On the toolbar, click More > Verify.

10

Select the imported CPUSE package.

11

On the toolbar, click Install Update.

12

The online installation starts immediately. The Security Gateway reboots when installation is complete.

1

In your web browser, connect to the Gaia Portal on the R77.30 Security Gateway at:

https://<IP address of Gaia Management Interface>

2

From the left tree, click Upgrades (CPUSE) > Status and Actions.

3

Above the list of all software packages, click Showing Recommended packages and select All.

4

Select the vSEC Controller Hotfix package.

5

On the toolbar, click Uninstall.

6

The Security Gateway reboots when uninstall is complete.

1

Download the R77.20 vSEC Controller Enforcer Hotfix package.

2

Transfer the package to the R77.20 Security Gateway.

3

Connect to the command line the R77.20 Security Gateway.

4

Log in to the Expert mode.

5

Extract the package:

# tar zxvf <HOTFIX_NAME>.tgz

6

Install the package:

# ./fw1_wrapper_<HOTFIX_NAME>

7

Follow the instructions on the screen.

8

Reboot the R77.20 Security Gateway.

1

Connect to the command line the R77.20 Security Gateway.

2

Log in to the Expert mode.

3

Uninstall the package:

# cd /opt/CPSuite-R77.20/

# ./uninstall_fw1_wrapper_<HOTFIX_NAME>

For the correct file name, see sk111963.

4

Reboot the R77.20 Security Gateway.

1

In SmartConsole, from the left navigation panel, click Gateways & Servers.

2

Open the applicable Security Gateway object.

3

From the left tree, click General Properties.

4

On the Network Security tab, select the Identity Awareness Software Blade.

The Identity Awareness Configuration > Methods for Acquiring Identity window opens.

Clear the AD Query, if it is not necessary.

5

Select I do not wish to configure an Active Directory at this time.

The Identity Awareness Software Blade is activated by default.

6

Click Next > Finish.

7

From the left tree, click Identity Awareness.

8

Select Identity Web API.

9

Click Settings.

The Identity Web API Settings window opens.

10

From the Authorized Clients section, add the 127.0.0.1 host object.

11

In the Selected Client Secret, enter a secret word.

Press Generate to create the client secret.

Click OK.

12

Install the Access Control Policy.

1

In SmartConsole, from the left navigation panel, click Gateways & Servers.

2

Open the applicable Security Gateway object.

3

From the left tree, click General Properties.

4

On the Network Security tab, select the Identity Awareness Software Blade.

The Identity Awareness Configuration > Methods for Acquiring Identity window opens.

Clear the AD Query, if it is not necessary.

5

Select Terminal Servers > Next.

The Identity Awareness Configuration > Integration with Active Directory window opens.

6

Select I do not wish to configure an Active Directory at this time.

The Identity Awareness Software Blade is activated by default.

7

Click Next > Finish.

8

Click OK.

9

Install the Access Control Policy.

1

Connect to the command line on each applicable Security Gateway.

2

Log in to Gaia Clish, or Expert mode.

3

Enable the Identity Awareness API:

pdp api enable

Note: On a VSX Gateway, run the command in the context of each applicable Virtual System.